Re: I would like to tcpdump and get all the packets...

From: Michael Sierchio (kudzu_at_tenebras.com)
Date: 09/18/03

  • Next message: Lars Eggert: "Re: I would like to tcpdump and get all the packets..." 
    Date: Thu, 18 Sep 2003 07:17:53 -0700
To: freebsd-net@freebsd.org

    Josh Brooks wrote:
    > Whenever I run:
    >
    > tcpdump -vvv
    >
    > when I am finished, I am surprised to see:
    >
    > 27441 packets received by filter
    > 7866 packets dropped by kernel

    The time it takes to resolve host names, probably, and the additional
    burden of writing the service names, where known, etc.

    Try

    tcpdump -vvv -n

    or

    tcpdump -vvv -ln

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Lars Eggert: "Re: I would like to tcpdump and get all the packets..."

    Relevant Pages

    • Re: TCP Dump Filters
      ... but can you FILTER on the contents of the payload? ... filter on all kinds of packet characteristics like port, ... would be a major drawback in the use of TCPdump as an IDS engine. ...
      (Focus-IDS)
    • odd tcpdump output w/ 6.0-BETA2 ...
      ... I get useless output from tcpdump (no ... header or protocol decode) but only when I specify a filter on the ... use -v or -vv for full protocol decode ... packets received by filter ...
      (freebsd-net)
    • Re: Packet capturing, iptables and eth0 vs. dummy0
      ... That's because when you try locally, you end up using lo0, not eth0. ... > Let's say that I'm filtering all incoming TCP SYN packets on all ... > I'm listening, with tcpdump, to all packets in eth0. ... > connect (without the filter I can do it normally), ...
      (Linux-Kernel)
    • RE: newbie tcpdump question
      ... And tcpdump will allow you to see data between points. ... On my local network there are two totally different subnets together ... traffic between the ordinary IP numbered hosts and other ordinary IP ... not been able to come up with a tcpdump filter that actually works to do ...
      (Focus-IDS)
    • Re: tcpdump: capturing traffic only from external hosts
      ... Second filter, ... tcpdump on the host 10.0.0.101, so I have scrubbed the host bit, and used the ... port number to restrict the logging against that port. ... Unfortunately tcpdump logs the traffic before the netfilter, ...
      (comp.os.linux.networking)